Pattern matching is utilized by a wide variety of applications in both security and non-security-related environments. In the realm of security-related applications, pattern matching has been used to combat intrusion attacks. Intrusion attacks on computer networks are a major problem in today's networked computing environment. An intrusion attack occurs when an intruder either breaches a network and/or computer, or at least temporarily has an unwanted influence on it.
A variety of intrusion detection systems (IDSs) have been developed to detect and moreover prevent intrusion attacks. In order to detect intrusion attacks, IDSs typically include an intrusion scanning engine with one or more files known as attack signature files, which contain patterns pertaining to known types of intrusion attacks. Using such attack signature files, IDSs examine packets that pass on a network and attempt to identify the various patterns of known attacks. When an IDS detects characteristics of a known intrusion attack, a system administrator is typically notified along with any other desired response.
IDSs typically require near real-time testing for the presence of thousands of patterns in network packets. Sequential scanning of each network packet for pattern matches is far too slow for achieving desired throughput. Thus, state of the art IDSs either use hardware accelerated pattern matching devices, a costly solution, or utilize string search algorithms, such as Boyer-Moore.
In any case, to further maintain the desired throughput, traditional IDSs utilize pattern matching systems which stop after having detected a first pattern match. When stopped, the scanning is terminated and a desired response to such first pattern match is carried out, without scanning for any remaining untested patterns. Unfortunately, this early termination of the scanning results, in some situations, in fewer than all possible matches (and associated response, etc.).
There is thus a need for overcoming these and/or other problems associated with the prior art.